CVE-2026-104137

Prior to version 8.3.0 , OpenEMR is vulnerable to an Improper Access Control (CWE-284) issue within the sms_search branch of interface/main/messages/save.php. While the component requires an authenticated session, it fails to enforce patient or feature-level ACLs. This allows a low-privilege user...